阿里云容器服务Kubernetes用户授权管理分为2个级别：一个是RAM访问控制，即设定用户对k8s集群的访问权限，比如查看集群列表，创建/删除集群的权限，是否能够对集群进行扩容等等；另一个是需要在集群内对用户进行细粒度的授权，比如是否允许用户部署应用，以及对集群内资源的修改删除。本文将对这两个部分进行简单介绍，从而掌握对集群的正确授权管理，特别演示了如何单独创建集群用户并为其授权的过程。

Kubernetes 阿里云容器服务RAM访问控制

在RAM访问控制里面，有2个系统策略：AliyunCSFullAccess和AliyunCSReadOnlyAccess。很明显前者是具有对k8s集群的完全访问控制，能够在阿里云控制台创建删除集群。而后这只读权限的内容是"cs:Get"，也就是说只具有Get权限。这两个系统策略的颗粒度是比较大的，要想精细化权限管理，需要进行自定义策略并赋给指定用户。下表是所有集群具有的操作（参考自定义 RAM 授权策略）：

阿里云环境如何用子账号对用户进行授权

具有阿里云RAM权限只是具有管理阿里云集群的第一步，要进行集群的使用和运维，还需要利用Kubernetes RBAC进行单独的访问控制。

其实这个跟阿里云的RAM访问控制Policy比较类似，就是描述谁可以对K8S的资源进行什么样的操作。不同的策略赋给不同的用户，阿里云预置的一组策略可以关联于角色Role，然后在阿里云集群授权中就可以将相应的Role赋给具体某一用户。这里面看到的管理员，运维人员，开发人员等其实就是不同的角色，后面我们可以看到他们对应的具体Policy。

阿里云主账号具有最大的管理权限，可以做集群的授权操作，但一般我们不建议用主账号做太多的操作，所以尽量用管理员账户操作就可以了。但对于K8S授权，即使是系统管理员，在对集群做授权时，也会提示“当前子账号不具备授权管理权限，请联系主帐号或权限管理员授权。”，这是因为K8S授权需要先用主账号对集群的管理员先赋予集群管理员角色，这样这个管理员才能对其它子账号进行授权操作。准确地说，授权需要满足2个条件，一个是RAM访问控制读权限（参考link），另一个是集群中对apiGroups的rbac.authorization.k8s.io的访问权限。

Kubernetes RBAC（Role Based Access Control）基于角色的访问控制

我们用下面的命令可以查看K8S中的ClusterRole，ClusterRoleBinding。

# kubectl get ClusterRole
NAME                                                                   AGE
admin                                                                  1y
ahas                                                                   245d
alibaba-log-controller                                                 1y
alicloud-disk-controller-runner                                        1y
arms-pilot-ack-arms-pilot-role                                         200d
cluster-admin                                                          1y
cs:admin                                                               340d
cs:dev                                                                 340d
cs:heapster                                                            1y
cs:ns:dev                                                              1y
cs:ops                                                                 337d
cs:restricted                                                          340d
deployment-reader                                                      1y
drain-node                                                             109d
edit                                                                   1y
flannel                                                                1y
kube-state-metrics                                                     1y
nginx-ingress-controller                                               320d
pod-reader                                                             1y
system:aggregate-to-admin                                              1y
system:aggregate-to-edit                                               1y
system:aggregate-to-view                                               1y
system:auth-delegator                                                  1y
system:aws-cloud-provider                                              1y
system:basic-user                                                      1y
system:certificates.k8s.io:certificatesigningrequests:nodeclient       1y
system:certificates.k8s.io:certificatesigningrequests:selfnodeclient   1y
system:cloud-controller-manager                                        1y
system:controller:attachdetach-controller                              1y
system:controller:certificate-controller                               1y
system:controller:clusterrole-aggregation-controller                   1y
system:controller:cronjob-controller                                   1y
system:controller:daemon-set-controller                                1y
system:controller:deployment-controller                                1y
system:controller:disruption-controller                                1y
system:controller:endpoint-controller                                  1y
system:controller:expand-controller                                    1y
system:controller:generic-garbage-collector                            1y
system:controller:horizontal-pod-autoscaler                            1y
system:controller:job-controller                                       1y
system:controller:namespace-controller                                 1y
system:controller:node-controller                                      1y
system:controller:persistent-volume-binder                             1y
system:controller:pod-garbage-collector                                1y
system:controller:pv-protection-controller                             1y
system:controller:pvc-protection-controller                            1y
system:controller:replicaset-controller                                1y
system:controller:replication-controller                               1y
system:controller:resourcequota-controller                             1y
system:controller:route-controller                                     1y
system:controller:service-account-controller                           1y
system:controller:service-controller                                   1y
system:controller:statefulset-controller                               1y
system:controller:ttl-controller                                       1y
system:coredns                                                         1y
system:csi-external-attacher                                           1y
system:csi-external-provisioner                                        1y
system:discovery                                                       1y
system:heapster                                                        1y
system:kube-aggregator                                                 1y
system:kube-controller-manager                                         1y
system:kube-dns                                                        1y
system:kube-scheduler                                                  1y
system:kubelet-api-admin                                               1y
system:node                                                            1y
system:node-bootstrapper                                               1y
system:node-problem-detector                                           1y
system:node-proxier                                                    1y
system:persistent-volume-provisioner                                   1y
system:volume-scheduler                                                1y
test-role                                                              2h
view                                                                   1y

查看ClusterRoleBinding：

# kubectl get clusterrolebinding
NAME                                                   AGE
202729146928739501-clusterrolebinding                  218d
202865947013061057-clusterrolebinding                  336d
203542248038995370-clusterrolebinding                  333d
204696546927216725-clusterrolebinding                  1d
admin                                                  1y
ahas                                                   245d
alibaba-log-controller                                 1y
aliyun-acr-credential-helper-rolebinding               1y
arms-pilot-ack-arms-pilot-role-binding                 200d
cluster-admin                                          1y
deployment-reader                                      1y
drain-node                                             109d
flannel                                                1y
global-job-controller-role-binding                     329d
kube-state-metrics                                     1y
kubeadm:kubelet-bootstrap                              1y
kubeadm:node-autoapprove-bootstrap                     1y
kubeadm:node-autoapprove-certificate-rotation          1y
kubeadm:node-proxier                                   1y
nginx-ingress-controller-starterservices-dev           224d
nginx-ingress-controller-starterservices-gadev         320d
node-masters-role-binding                              329d
pod-reader                                             1y
run-alicloud-disk-controller                           1y
system:aws-cloud-provider                              1y
system:basic-user                                      1y
system:cloud-controller-manager                        1y
system:cloud-node-controller                           1y
system:controller:attachdetach-controller              1y
system:controller:certificate-controller               1y
system:controller:clusterrole-aggregation-controller   1y
system:controller:cronjob-controller                   1y
system:controller:daemon-set-controller                1y
system:controller:deployment-controller                1y
system:controller:disruption-controller                1y
system:controller:endpoint-controller                  1y
system:controller:expand-controller                    1y
system:controller:generic-garbage-collector            1y
system:controller:horizontal-pod-autoscaler            1y
system:controller:job-controller                       1y
system:controller:namespace-controller                 1y
system:controller:node-controller                      1y
system:controller:persistent-volume-binder             1y
system:controller:pod-garbage-collector                1y
system:controller:pv-protection-controller             1y
system:controller:pvc-protection-controller            1y
system:controller:replicaset-controller                1y
system:controller:replication-controller               1y
system:controller:resourcequota-controller             1y
system:controller:route-controller                     1y
system:controller:service-account-controller           1y
system:controller:service-controller                   1y
system:controller:statefulset-controller               1y
system:controller:ttl-controller                       1y
system:coredns                                         1y
system:discovery                                       1y
system:kube-controller-manager                         1y
system:kube-dns                                        1y
system:kube-scheduler                                  1y
system:node                                            1y
system:node-proxier                                    1y
system:pvl-controller                                  1y
system:route-controller                                1y
system:shared-informers                                1y
system:volume-scheduler                                1y
test-rolebinding                                       2h
tiller-cluster-rule                                    1y

cs:admin, cs:ops, cs:dev, cs:restricted分别代表阿里云预置的4个角色：管理员，运维人员，开发人员，受限用户，它们的权限依次递减，其中受限用户只对部分资源具有读权限。

我们查看其中的一个ClusterRoleBinding, ID为202729146928739501用户赋予了cs:ops的角色。

# kubectl get clusterrolebinding/202729146928739501-clusterrolebinding -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  creationTimestamp: 2019-08-19T05:22:03Z
  name: 202729146928739501-clusterrolebinding
  resourceVersion: "111811902"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterrolebindings/202729146928739501-clusterrolebinding
  uid: 46ec07c5-c241-11e9-b90f-00163e00519d
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: cs:ops
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: "202729146928739501"

接下来就可以继续查看cs:ops到底具有什么样的权限:

# kubectl get clusterrole/cs:ops -o yaml
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  creationTimestamp: 2019-04-22T07:57:30Z
  name: cs:ops
  resourceVersion: "47812320"
  selfLink: /apis/rbac.authorization.k8s.io/v1/clusterroles/cs%3Aops
  uid: 472ef445-64d4-11e9-bb7e-00163e06e73f
rules:
- apiGroups:
  - ""
  resources:
  - pods
  - pods/attach
  - pods/exec
  - pods/portforward
  - pods/proxy
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - configmaps
  - endpoints
  - persistentvolumeclaims
  - replicationcontrollers
  - replicationcontrollers/scale
  - secrets
  - serviceaccounts
  - services
  - services/proxy
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - ""
  resources:
  - bindings
  - events
  - limitranges
  - namespaces/status
  - replicationcontrollers/status
  - pods/log
  - pods/status
  - resourcequotas
  - resourcequotas/status
  - componentstatuses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - ""
  resources:
  - namespaces
  - nodes
  - persistentvolumes
  verbs:
  - get
  - list
  - watch
  - patch
- apiGroups:
  - apps
  resources:
  - daemonsets
  - deployments
  - deployments/rollback
  - deployments/scale
  - replicasets
  - replicasets/scale
  - statefulsets
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - autoscaling
  resources:
  - horizontalpodautoscalers
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - batch
  resources:
  - cronjobs
  - jobs
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - extensions
  resources:
  - daemonsets
  - deployments
  - deployments/rollback
  - deployments/scale
  - ingresses
  - replicasets
  - replicasets/scale
  - replicationcontrollers/scale
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - servicecatalog.k8s.io
  resources:
  - clusterserviceclasses
  - clusterserviceplans
  - clusterservicebrokers
  - serviceinstances
  - servicebindings
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - servicecatalog.k8s.io
  resources:
  - clusterservicebrokers/status
  - clusterserviceclasses/status
  - clusterserviceplans/status
  - serviceinstances/status
  - serviceinstances/reference
  - servicebindings/status
  verbs:
  - update
- apiGroups:
  - storage.k8s.io
  resources:
  - storageclasses
  verbs:
  - get
  - list
  - watch
- apiGroups:
  - alicloud.com
  resources:
  - '*'
  verbs:
  - create
  - delete
  - get
  - list
  - patch
  - update
  - watch
- apiGroups:
  - policy
  resources:
  - poddisruptionbudgets
  verbs:
  - create
  - delete
  - deletecollection
  - get
  - list
  - patch
  - update
  - watch

阿里云授权页面中的自定义就是可以选取集群中已经存在的一些角色，当然也可以创建自己的权限和角色，然后分配给指定的用户。

如何为Kubernetes创建一个独立于阿里云的用户并进行授权

除了在阿里云容器服务控制台中对阿里云用户进行授权外，集群管理者也可以单独创建一个用户并对其进行授权，这样就可以给一个没有阿里云账户的用户通过api或者kubectl命令来使用和管理集群。以下的步骤举例说明如何创建用户bob，并给bob授权，以及bob如何配置使用。

创建用户

登陆到master节点
# cd /etc/kubernetes/pki
创建bob 私钥
# openssl genrsa -out bob.key 2048
创建bob CSR，并将bob分配到test这个组中。
# openssl req -new -key bob.key -out bob.csr -subj "/CN=bob/O=test"
通过集群CA签发bob证书。管理员将证书文件和bob的私钥一起发给bob用户。
# openssl x509 -req -in bob.csr -CA ca.pem -CAkey ca-key.pem -CAcreateserial -out bob.crt -days 365

上面在创建bob CSR的时候/CN=bob代表用户名，/O=test代表用户所在的组。system:masters是系统组，如果选择这个组，用户缺省就具有了cluster admin的权限。

bob如何配置使用证书

bob得到CA签发的证书和私钥后，首先需要下载kubectl，然后通过下面命令配置.kube/config文件。

#添加集群连接信息。包括CA证书。
C:\Users\mdw3sr\Desktop>kubectl config set-cluster sandbox --certificate-authority=ca.crt --embed-certs=true --server=https://<K8S集群公网IP>:6443
Cluster "sandbox" set.
#将bob密钥信息加入配置中
C:\Users\mdw3sr\Desktop>kubectl config set-credentials bob --client-certificate=bob.crt --client-key=bob.key --embed-certs=true
User "bob" set.
#将新的context入口加入配置中
C:\Users\mdw3sr\Desktop>kubectl config set-context bob --cluster=sandbox --user=bob
Context "kubernetes" created.
#使用bob context
C:\Users\mdw3sr\Desktop>kubectl config use-context bob
Switched to context "bob".

这样运行kubectl cluster-info就能看到集群信息了，虽然还有些信息因为权限问题不能正确显示。

C:\Users\mdw3sr\Desktop>kubectl cluster-info
Kubernetes master is running at https://106.15.157.9:6443

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
Error from server (Forbidden): services is forbidden: User "bob" cannot list resource "services" in API group "" in the namespace "kube-system"
C:\Users\mdw3sr\Desktop>kubectl get pod
No resources found.
Error from server (Forbidden): pods is forbidden: User "bob" cannot list resource "pods" in API group "" in the namespace "default"

为用户bob设置权限

从上面结果可以看出，如果没有设置任何权限，bob在集群内是没有任何资源访问能力，所以管理员需要对bob进行集群内授权。

为bob创建ClusterRole和ClusterRoleBinding
# cat > test.yaml <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: test-role
rules:
- apiGroups: [""]
  resources: ["pods","services"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: test-rolebinding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: test-role
subjects:
- apiGroup: rbac.authorization.k8s.io
  kind: User
  name: bob
EOF

# kubectl apply -f test.yaml
clusterrole.rbac.authorization.k8s.io/test-role created
clusterrolebinding.rbac.authorization.k8s.io/test-rolebinding created

然后，bob这边再测试之前的命令，就可以正确执行了。结果如下:

C:\Users\mdw3sr\Desktop>kubectl cluster-info
Kubernetes master is running at https://106.10.157.9:6443
Heapster is running at https://106.10.157.9:6443/api/v1/namespaces/kube-system/services/heapster/proxy
KubeDNS is running at https://106.10.157.9:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy
monitoring-influxdb is running at https://106.10.157.9:6443/api/v1/namespaces/kube-system/services/monitoring-influxdb/proxy

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.

C:\Users\mdw3sr\Desktop>kubectl get pod
NAME                              READY     STATUS    RESTARTS   AGE
nginx-deployment-bb54749c-426cb   1/1       Running   0          104d
nginx-deployment-bb54749c-qcvc5   1/1       Running   0          104d
nginx-v1-5bc8bf76db-7rnkf         1/1       Running   1          230d
nginx-v1-5bc8bf76db-r7k5r         1/1       Running   0          185d
patch-demo-7f54465dd5-jhr5c       2/2       Running   0          29d
patch-demo-7f54465dd5-w5hx2       2/2       Running   0          29d

# 因为并没有赋给bob 获取namespace的权限，所以bob仍然不能访问namespace信息。
C:\Users\mdw3sr\Desktop>kubectl get ns
No resources found.
Error from server (Forbidden): namespaces is forbidden: User "bob" cannot list resource "namespaces" in API group "" at the cluster scope

大家也可以通过对bob设置不同的权限来学习验证具体的行为。